diff --git a/src/confd/bin/pppmon.c b/src/confd/bin/pppmon.c
index f1477de07..77708673d 100644
--- a/src/confd/bin/pppmon.c
+++ b/src/confd/bin/pppmon.c
@@ -24,6 +24,7 @@
 #include <unistd.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
+#include <net/if.h>
 #include <linux/if_link.h>
 #include <linux/netlink.h>
 #include <linux/ppp-ioctl.h>
@@ -182,6 +183,12 @@ int main(int argc, char *argv[])
 	ifname = argv[optind];
 	openlog("pppmon", LOG_PID | LOG_PERROR, LOG_DAEMON);
 
+	/* Same limit as the kernel, also bounds the netlink request */
+	if (strlen(ifname) >= IFNAMSIZ) {
+		syslog(LOG_ERR, "interface name too long, max %d chars", IFNAMSIZ - 1);
+		return 1;
+	}
+
 	fd = open("/dev/ppp", O_RDWR);
 	if (fd < 0) {
 		syslog(LOG_ERR, "%s: failed opening /dev/ppp: %m", ifname);
diff --git a/src/confd/src/if-ppp.c b/src/confd/src/if-ppp.c
index dc345184b..975f773a7 100644
--- a/src/confd/src/if-ppp.c
+++ b/src/confd/src/if-ppp.c
@@ -156,22 +156,25 @@ static int ppp_gen_settings(struct lyd_node *cif)
 	return 0;
 }
 
-/* Replace file with file+ if they differ, returns 1 if it did */
+/* Replace file with file+ if they differ: 1 if replaced, 0 if not, -1 on error */
 static int ppp_update(const char *fmt, const char *ifname)
 {
 	char path[256], next[260];
-	int changed;
 
 	snprintf(path, sizeof(path), fmt, ifname);
 	snprintf(next, sizeof(next), "%s+", path);
 
-	changed = systemf("cmp -s %s %s", path, next) != 0;
-	if (changed)
-		rename(next, path);
-	else
-		remove(next);
+	if (!systemf("cmp -s %s %s", path, next)) {
+		(void)remove(next);
+		return 0;
+	}
+
+	if (rename(next, path)) {
+		ERRNO("%s: failed replacing %s", ifname, path);
+		return -1;
+	}
 
-	return changed;
+	return 1;
 }
 
 /*
@@ -224,8 +227,11 @@ int ppp_gen(sr_session_ctx_t *session, struct lyd_node *dif, struct lyd_node *ci
 		return err;
 
 	/* Finit restarts pppd on its own when the env file changes */
-	ppp_update(PPP_SETTINGS, ifname);
+	if (ppp_update(PPP_SETTINGS, ifname) < 0)
+		return -EIO;
 	restart = ppp_update(PPP_PEERS, ifname);
+	if (restart < 0)
+		return -EIO;
 
 	if (lydx_is_enabled(cif, "enabled")) {
 		finit_enablef("pppd@%s", ifname);
diff --git a/src/confd/src/locate.c b/src/confd/src/locate.c
index d28ccdde0..ee2de581d 100644
--- a/src/confd/src/locate.c
+++ b/src/confd/src/locate.c
@@ -44,8 +44,11 @@ static json_t *iitod_call(json_t *req, const char **err)
 	}
 
 	/* Do not let a stuck iitod block confd, this also bounds connect() */
-	setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
-	setsockopt(sd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+	if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) ||
+	    setsockopt(sd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
+		*err = "failed setting socket timeout";
+		goto done;
+	}
 
 	if (connect(sd, (struct sockaddr *)&sun, sizeof(sun))) {
 		if (errno == ENOENT)